CVE-2007-3319

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-06-21 · updated 2026-06-16

Description

The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.

Affected products

Avaya 4602Sw Ip Phone: r2.2

References

http://osvdb.org/38115
http://secunia.com/advisories/25747
http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm
http://www.securityfocus.com/bid/24539
http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299&
https://exchange.xforce.ibmcloud.com/vulnerabilities/34972
http://osvdb.org/38115
http://secunia.com/advisories/25747
http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm
http://www.securityfocus.com/bid/24539
http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299&
https://exchange.xforce.ibmcloud.com/vulnerabilities/34972

Get alerted when CVE-2007-3319 or the next vulnerability affects your stack